## What does this PR do? This PR implements attributes PBAC - router checks + UI ## Visual Demo (For contributors especially) A visual demonstration is strongly recommended, for both the original and new change **(video / image - any one)**. #### Video Demo (if applicable): - Show screen recordings of the issue or feature. - Demonstrate how to reproduce the issue, the behavior before and after the change. #### Image Demo (if applicable): - Add side-by-side screenshots of the original and updated change. - Highlight any significant change(s). ## Mandatory Tasks (DO NOT REMOVE) - [ ] I have self-reviewed the code (A decent size PR without self-review might be rejected). - [ ] I have updated the developer docs in /docs if this PR makes changes that would require a [documentation change](https://cal.com/docs). If N/A, write N/A here and check the checkbox. - [ ] I confirm automated tests are in place that prove my fix is effective or that my feature works. ## How should this be tested? Enable PBAC on an org Create a custom role -> advanced -> organizations -> "editUser" Assign it to a user impersonate user test they have access to all things attributes remove permissions check they dont have permissions. ## Checklist <!-- Remove bullet points below that don't apply to you --> - I haven't read the [contributing guide](https://github.com/calcom/cal.com/blob/main/CONTRIBUTING.md) - My code doesn't follow the style guidelines of this project - I haven't commented my code, particularly in hard-to-understand areas - I haven't checked if my changes generate no new warnings <!-- This is an auto-generated description by cubic. --> --- ## Summary by cubic Adds a new PBAC “editUsers” permission and read gating for Attributes, updating the UI and backend so users can view and edit attributes only when allowed. - **New Features** - Added CustomAction.EditUsers to the permission registry for organization-scoped attribute editing. - Settings computes canViewAttributes and shows the Attributes tab only when allowed. - Members page fetches Attributes permissions and exposes canViewAttributes and canEditAttributesForUser to the UI. - User Edit Sheet hides attributes without read permission and shows attribute editing and the bulk “Mass Assign Attributes” action only with editUsers; other user edits depend on changeMemberRole. - Attributes TRPC router gates create/edit/delete/toggle via PBAC and requires organization.attributes.editUsers for assign/bulk-assign; added a helper to create PBAC-aware procedures. - **Migration** - Run the new Prisma migration to seed the admin role with editUsers. - If using custom roles, grant Edit Users under Attributes as needed. <sup>Written for commit 856aa2e8e1521fc22cd71cb0fa6d720036efe8a2. Summary will update automatically on new commits.</sup> <!-- End of auto-generated description by cubic. -->
164 lines
6.5 KiB
TypeScript
164 lines
6.5 KiB
TypeScript
import type { Dispatch } from "react";
|
|
import { shallow } from "zustand/shallow";
|
|
|
|
import { useOrgBranding } from "@calcom/ee/organizations/context/provider";
|
|
import { WEBAPP_URL } from "@calcom/lib/constants";
|
|
import { useLocale } from "@calcom/lib/hooks/useLocale";
|
|
import { trpc } from "@calcom/trpc/react";
|
|
import { Avatar } from "@calcom/ui/components/avatar";
|
|
import { Sheet, SheetContent, SheetBody, SheetHeader, SheetFooter } from "@calcom/ui/components/sheet";
|
|
import { Loader } from "@calcom/ui/components/skeleton";
|
|
|
|
import type { UserTableAction, UserTableState } from "../types";
|
|
import { DisplayInfo } from "./DisplayInfo";
|
|
import { EditForm } from "./EditUserForm";
|
|
import { OrganizationBanner } from "./OrganizationBanner";
|
|
import { SheetFooterControls } from "./SheetFooterControls";
|
|
import { useEditMode } from "./store";
|
|
|
|
function removeProtocol(url: string) {
|
|
return url.replace(/^(https?:\/\/)/, "");
|
|
}
|
|
|
|
export function EditUserSheet({
|
|
state,
|
|
dispatch,
|
|
canViewAttributes,
|
|
canEditAttributesForUser,
|
|
canChangeMemberRole,
|
|
}: {
|
|
state: UserTableState;
|
|
dispatch: Dispatch<UserTableAction>;
|
|
canViewAttributes?: boolean;
|
|
canEditAttributesForUser?: boolean;
|
|
canChangeMemberRole?: boolean;
|
|
}) {
|
|
const { t } = useLocale();
|
|
const { user: selectedUser } = state.editSheet;
|
|
const orgBranding = useOrgBranding();
|
|
const [editMode, setEditMode] = useEditMode((state) => [state.editMode, state.setEditMode], shallow);
|
|
const { data: loadedUser, isPending } = trpc.viewer.organizations.getUser.useQuery(
|
|
{
|
|
userId: selectedUser?.id,
|
|
},
|
|
{
|
|
enabled: !!selectedUser?.id,
|
|
}
|
|
);
|
|
|
|
const { data: usersAttributes, isPending: usersAttributesPending } =
|
|
trpc.viewer.attributes.getByUserId.useQuery(
|
|
{
|
|
// @ts-expect-error We know it exists as it is only called when selectedUser is defined
|
|
userId: selectedUser?.id,
|
|
},
|
|
{
|
|
enabled: !!selectedUser?.id && !!canViewAttributes,
|
|
}
|
|
);
|
|
|
|
const avatarURL = `${orgBranding?.fullDomain ?? WEBAPP_URL}/${loadedUser?.username}/avatar.png`;
|
|
|
|
const schedulesNames = loadedUser?.schedules && loadedUser?.schedules.map((s) => s.name);
|
|
const teamNames =
|
|
loadedUser?.teams && loadedUser?.teams.map((t) => `${t.name} ${!t.accepted ? "(pending)" : ""}`);
|
|
|
|
return (
|
|
<Sheet
|
|
open={true}
|
|
onOpenChange={() => {
|
|
setEditMode(false);
|
|
dispatch({ type: "CLOSE_MODAL" });
|
|
}}>
|
|
<SheetContent className="bg-default">
|
|
{!isPending && loadedUser ? (
|
|
<>
|
|
{!editMode ? (
|
|
<>
|
|
<SheetHeader showCloseButton={false} className="w-full">
|
|
<div className="border-sublte bg-default w-full rounded-xl border p-4">
|
|
<OrganizationBanner />
|
|
<div className="bg-default ml-3 w-fit translate-y-[-50%] rounded-full p-1 ring-1 ring-[#0000000F]">
|
|
<Avatar asChild size="lg" alt={`${loadedUser?.name} avatar`} imageSrc={avatarURL} />
|
|
</div>
|
|
<h2 className="text-emphasis font-sans text-2xl font-semibold">
|
|
{loadedUser?.name || "Nameless User"}
|
|
</h2>
|
|
<p className="text-subtle max-h-[3em] overflow-hidden text-ellipsis text-sm font-normal">
|
|
{loadedUser?.bio || "This user does not have a bio..."}
|
|
</p>
|
|
</div>
|
|
</SheetHeader>
|
|
<SheetBody className="stack-y-4 flex flex-col p-4">
|
|
<div className="stack-y-4 mb-4 flex flex-col">
|
|
<h3 className="text-emphasis mb-1 text-base font-semibold">{t("profile")}</h3>
|
|
<DisplayInfo
|
|
label="Cal"
|
|
value={removeProtocol(
|
|
`${orgBranding?.fullDomain ?? WEBAPP_URL}/${loadedUser?.username}`
|
|
)}
|
|
icon="external-link"
|
|
/>
|
|
<DisplayInfo label={t("email")} value={loadedUser?.email ?? ""} icon="at-sign" />
|
|
<DisplayInfo label={t("role")} value={[loadedUser?.role ?? ""]} icon="fingerprint" />
|
|
<DisplayInfo label={t("timezone")} value={loadedUser?.timeZone ?? ""} icon="clock" />
|
|
<DisplayInfo
|
|
label={t("teams")}
|
|
value={!teamNames || teamNames.length === 0 ? "" : teamNames}
|
|
icon="users"
|
|
coloredBadges
|
|
/>
|
|
<DisplayInfo
|
|
label={t("availability")}
|
|
value={!schedulesNames || schedulesNames.length === 0 ? "" : schedulesNames}
|
|
icon="calendar"
|
|
/>
|
|
</div>
|
|
{canViewAttributes && usersAttributes && usersAttributes?.length > 0 && (
|
|
<div className="mt-4 flex flex-col">
|
|
<h3 className="text-emphasis mb-5 text-base font-semibold">{t("attributes")}</h3>
|
|
<div className="stack-y-4 flex flex-col">
|
|
{usersAttributes.map((attribute, index) => (
|
|
<>
|
|
<DisplayInfo
|
|
key={index}
|
|
label={attribute.name}
|
|
value={
|
|
["TEXT", "NUMBER", "SINGLE_SELECT"].includes(attribute.type)
|
|
? attribute.options[0].value
|
|
: attribute.options.map((option) => option.value)
|
|
}
|
|
/>
|
|
</>
|
|
))}
|
|
</div>
|
|
</div>
|
|
)}
|
|
</SheetBody>
|
|
<SheetFooter>
|
|
<SheetFooterControls
|
|
canEditAttributesForUser={canEditAttributesForUser}
|
|
canChangeMemberRole={canChangeMemberRole}
|
|
/>
|
|
</SheetFooter>
|
|
</>
|
|
) : (
|
|
<>
|
|
<EditForm
|
|
selectedUser={loadedUser}
|
|
avatarUrl={loadedUser.avatarUrl ?? avatarURL}
|
|
domainUrl={orgBranding?.fullDomain ?? WEBAPP_URL}
|
|
dispatch={dispatch}
|
|
canEditAttributesForUser={canEditAttributesForUser}
|
|
/>
|
|
</>
|
|
)}
|
|
</>
|
|
) : (
|
|
<Loader />
|
|
)}
|
|
</SheetContent>
|
|
</Sheet>
|
|
);
|
|
}
|